# Least-privilege policy for the External Secrets Operator audit-core lane.
#
# Covers:
#   - dynamic runtime PostgreSQL lease (database/creds/audit-core-runtime)
#   - dynamic migration PostgreSQL lease (database/creds/audit-core-migration)
#   - sender registry KV (platform/workloads/audit-core/senders)
#
# ClusterSecretStore openbao-audit-core is namespace-limited to audit-core.
# The runtime pod mounts only the runtime secret; the migrate Job mounts only
# the migration secret. This policy is the union ESO needs to vend both.

path "database/creds/audit-core-runtime" {
  capabilities = ["read"]
}

path "database/creds/audit-core-migration" {
  capabilities = ["read"]
}

path "platform/data/workloads/audit-core/senders" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/audit-core/senders" {
  capabilities = ["read"]
}